Vendor apple/containerization with a VM-extensions forwarding patch

Switch the containerization dependency from the github URL to a vendored copy (third_party/containerization, upstream commit 6b7b42ca) referenced by path, so we can carry a small local patch that upstream lacks: LinuxContainer.Configuration gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream already supports VMConfiguration.extensions + the VZInstanceExtension hook, but LinuxContainer — our only entry point — never forwarded them, so there was no way to attach a device (e.g. a memory balloon) to a container's VM. Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed for footprint (we never build the dependency's tests). See PATCHES.md for the full diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras product to NucleicCore (AddressAllocator, named in the configureVZ signature). Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-06-21 20:22:21 -07:00
commit 11b9825e09
280 changed files with 75699 additions and 0 deletions
@@ -0,0 +1,108 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the Containerization project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+#if os(Linux)
+
+import ContainerizationOS
+import Foundation
+import Synchronization
+
+struct ProcessSubscription: Sendable {
+    fileprivate let id: UUID
+}
+
+/// Protocol for running commands and waiting for their exit
+protocol CommandRunner: Sendable {
+    func start(_ cmd: inout Command) throws -> ProcessSubscription
+    func wait(_ cmd: Command, subscription: ProcessSubscription) async throws -> Int32
+}
+
+struct DirectCommandRunner: CommandRunner {
+    func start(_ cmd: inout Command) throws -> ProcessSubscription {
+        try cmd.start()
+        return ProcessSubscription(id: UUID())
+    }
+
+    func wait(_ cmd: Command, subscription: ProcessSubscription) async throws -> Int32 {
+        var rus = rusage()
+        var ws = Int32()
+
+        let result = wait4(cmd.pid, &ws, 0, &rus)
+        guard result == cmd.pid else {
+            throw POSIXError(.init(rawValue: errno)!)
+        }
+        return Command.toExitStatus(ws)
+    }
+}
+
+final class ReaperCommandRunner: CommandRunner, Sendable {
+    private struct Subscriber {
+        let continuation: AsyncStream<(pid: pid_t, status: Int32)>.Continuation
+        let stream: AsyncStream<(pid: pid_t, status: Int32)>
+    }
+
+    private let subscribers: Mutex<[UUID: Subscriber]> = Mutex([:])
+
+    func start(_ cmd: inout Command) throws -> ProcessSubscription {
+        // Subscribe before starting to avoid missing fast exits
+        let id = UUID()
+        let (stream, continuation) = AsyncStream<(pid: pid_t, status: Int32)>.makeStream()
+
+        subscribers.withLock { subscribers in
+            subscribers[id] = Subscriber(continuation: continuation, stream: stream)
+        }
+
+        try cmd.start()
+
+        return ProcessSubscription(id: id)
+    }
+
+    func wait(_ cmd: Command, subscription: ProcessSubscription) async throws -> Int32 {
+        let pid = cmd.pid
+        let id = subscription.id
+
+        defer {
+            subscribers.withLock { subscribers in
+                subscribers[id]?.continuation.finish()
+                subscribers.removeValue(forKey: id)
+            }
+        }
+
+        // Get the stream from the subscriber
+        guard let stream = subscribers.withLock({ $0[id]?.stream }) else {
+            throw POSIXError(.ECHILD)
+        }
+
+        for await (exitPid, status) in stream {
+            if exitPid == pid {
+                return status
+            }
+        }
+
+        throw POSIXError(.ECHILD)
+    }
+
+    /// Broadcast exit to all subscribers
+    func notifyExit(pid: pid_t, status: Int32) {
+        subscribers.withLock { subscribers in
+            for subscriber in subscribers.values {
+                subscriber.continuation.yield((pid, status))
+            }
+        }
+    }
+}
+
+#endif